Analysis
-
max time kernel
39s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 12:42
General
-
Target
1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.exe
-
Size
169KB
-
MD5
485edc4695212c4e97cf2e841661151c
-
SHA1
8d78e5b67eea3014f1a3530e68e7c1c21750990e
-
SHA256
1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650
-
SHA512
e5d520366b20bd57b1bd90abcc8e243e4a4d3f0e108c316da7ed0d6f715cc293971e616c479da5d29f09976de8f950ab8072e8fa0feaf848f2727150a86f141c
Score
10/10
Malware Config
Extracted
Family
coldstealer
Botnet
18
C2
http://realmoneycreate.xyz/
Signatures
-
Cold Stealer
An info stealer written in C#, first seen in Feb 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.exe"C:\Users\Admin\AppData\Local\Temp\1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
208KB